mirror of
https://github.com/github/codeql.git
synced 2026-04-23 15:55:18 +02:00
Rust: Add string slice taint flow test
This commit is contained in:
@@ -0,0 +1,4 @@
|
||||
import codeql.rust.dataflow.DataFlow
|
||||
import codeql.rust.dataflow.internal.TaintTrackingImpl
|
||||
|
||||
query predicate additionalTaintStep = RustTaintTracking::defaultAdditionalTaintStep/3;
|
||||
@@ -24,8 +24,27 @@ fn cast() {
|
||||
sink(b as i64); // $ MISSING: hasTaintFlow=77
|
||||
}
|
||||
|
||||
mod string {
|
||||
fn source(i: i64) -> String {
|
||||
format!("{}", i)
|
||||
}
|
||||
|
||||
fn sink(s: &str) {
|
||||
println!("{}", s);
|
||||
}
|
||||
|
||||
pub fn string_slice() {
|
||||
let s = source(35);
|
||||
let sliced = &s[1..3];
|
||||
sink(sliced); // $ MISSING: hasTaintFlow=35
|
||||
}
|
||||
}
|
||||
|
||||
use string::*;
|
||||
|
||||
fn main() {
|
||||
addition();
|
||||
negation();
|
||||
cast();
|
||||
string_slice();
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user